CVE-2026-41671 — Authentication Bypass
CVE-2026-41671 — Admidio is an open-source user management solution. Prior to version 5.0.9, the OIDC token introspection endpoint (/modules/sso/index.php/oidc/introspect) always returns {"active": true} for every request, regardless of whether a valid token is provided, whether the token is expired
What This Means For You
- If your environment is affected by CWE-287, review your exposure and prioritize patching based on your environment. Monitor vendor advisories for CVE-2026-41671 updates and patches.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Admidio OIDC Introspection Endpoint Authentication Bypass - CVE-2026-41671
title: Admidio OIDC Introspection Endpoint Authentication Bypass - CVE-2026-41671
id: scw-2026-05-07-ai-1
status: experimental
level: critical
description: |
Detects requests to the Admidio OIDC token introspection endpoint (/modules/sso/index.php/oidc/introspect) which, in versions prior to 5.0.9, always returns an active token regardless of validity. This indicates an attempt to exploit CVE-2026-41671 for authentication bypass.
author: SCW Feed Engine (AI-generated)
date: 2026-05-07
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-41671/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
uri|endswith:
- '/modules/sso/index.php/oidc/introspect'
cs-method:
- 'POST'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-41671 | vulnerability | CVE-2026-41671 |
| CWE-287 | weakness | CWE-287 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 07, 2026 at 07:16 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6214 — The Forminator Forms plugin for WordPress is vulnerable to
CVE-2026-6214 — The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the...
CVE-2026-42194 — Server-Side Request Forgery
CVE-2026-42194 — Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address...
CVE-2026-41670: Admidio SAML IdP Bypass Exposes User Data
CVE-2026-41670 — Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServiceURL value...